CVE-2026-127215

{
  "etk_id": "ETK-2026-4424",
  "cve_id": "CVE-2026-127215",
  "display_id": "CVE-2026-127215",
  "ghsa_id": "GHSA-r985-2wqx-6gh6",
  "euvd_id": "EUVD-2026-125752",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Authorization bypass in Kanbanz WordPress plugin",
  "summary": "Kanbanz versions before 1.0.3 do not consistently enforce board and task permissions. An authenticated user assigned the Kanban Staff role may view or modify boards belonging to other teams, including associated task data and attachments. Exploitation requires access to an authenticated Kanban Staff account.",
  "mitigation": "Upgrade Kanbanz to version 1.0.3 or later. Until upgraded, restrict Kanban Staff access to trusted users and review board permissions and activity for unauthorized changes.",
  "vendor": "Softaculous",
  "product": "Kanbanz",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, < 1.0.3"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "1.0.3"
      ],
      "package_name": "Kanbanz",
      "purl": null
    }
  ],
  "cwes": [
    639
  ],
  "cvss_score": 8.6,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 20.30510805,
  "t0_at": "2026-11-13T20:10:05.135000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-13T20:10:05.135000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-13T20:10:05.135000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-127215"
    }
  }
}